GENERATING RULE PACKS FOR MONITORING COMPUTER SYSTEMS

• US 20080155517A1
• Filed: 12/20/2006
• Published: 06/26/2008
• Est. Priority Date: 12/20/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Harris, Christopher J., Yan, An
• Granted Patent: US 8,799,448 B2
• Time in Patent Office: Days
• US Class Current: 717/140
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/88 Monitoring involving counting

Abstract

Improved systems and methods for developing rule packs can include receiving monitoring rules specified in a markup language, and combining them to produce a rule pack. Combining processes can leverage product development processes such as Integrated Development Environments (IDEs), thereby allowing any number of developers to work on the same rule pack simultaneously. Common settings may be added to rule packs in an automated, platform-specific way, thereby eliminating the need for rule writers to concern themselves with such common settings. Rule packs may be converted from a markup language to a binary file for use by a monitoring service.

Claims

1. A system for generating a rule pack comprising a plurality of monitoring rules for monitoring a computer, wherein a monitoring rule specifies an action to take in response to an event occurring in said computer, said system comprising:

a subsystem for receiving a plurality of monitoring rules, said plurality of monitoring rules specified in a markup language;

a subsystem for combining said plurality of monitoring rules to produce a rule pack;

a subsystem for adding to said rule pack at least one common setting, wherein a common setting applies to two or more monitoring rules in said rule pack, and wherein said at least one common setting is specified in a markup language; and

a subsystem for converting said rule pack from a markup language to a binary file for use by a monitoring service.

2. A system according to claim 1, wherein said subsystem for receiving a plurality of monitoring rules receives monitoring rules from two or more computer terminals.

3. A system according to claim 1, wherein said subsystem for combining said plurality of monitoring rules comprises a server computer equipped with Integrated Development Environment (IDE) software allowing a plurality of software developers to develop said monitoring rules simultaneously.

4. A system according to claim 1, wherein at least one of said plurality of monitoring rules specifies an event to monitor.

5. A system according to claim 1, wherein at least one of said plurality of monitoring rules specifies a counter to monitor.

6. A system according to claim 1, wherein at least one of said plurality of monitoring rules specifies a counter threshold.

7. A system according to claim 1, wherein at least one of said plurality of monitoring rules specifies an alert.

8. A system according to claim 1, wherein said at least one common setting comprises a setting for suppressing duplicate alerts.

9. A method for generating a rule pack comprising a plurality of monitoring rules for monitoring a computer, wherein a monitoring rule specifies an action to take in response to an event occurring in said computer, said method comprising:

receiving a plurality of monitoring rules, said plurality of monitoring rules specified in a markup language;

combining said plurality of monitoring rules to produce a rule pack;

adding to said rule pack at least one common setting, wherein a common setting applies to two or more monitoring rules in said rule pack, and wherein said at least one common setting is specified in a markup language; and

converting said rule pack from a markup language to a binary file for use by a monitoring service.

10. A method according to claim 9, wherein said receiving a plurality of monitoring rules comprises receiving monitoring rules from two or more computer terminals.

11. A method according to claim 9, wherein said combining said plurality of monitoring rules comprises is carried out by a server computer equipped with Integrated Development Environment (IDE) software allowing a plurality of software developers to develop said monitoring rules simultaneously.

12. A method according to claim 9, wherein at least one of said plurality of monitoring rules specifies an event to monitor.

13. A method according to claim 9, wherein at least one of said plurality of monitoring rules specifies a counter to monitor.

14. A method according to claim 9, wherein at least one of said plurality of monitoring rules specifies a counter threshold.

15. A method according to claim 9, wherein at least one of said plurality of monitoring rules specifies an alert.

16. A method according to claim 9, wherein said at least one common setting comprises a setting for suppressing duplicate alerts.

17. A method for separating a markup language rule pack file comprising monitoring rules for monitoring a computer into a plurality of rule group manifest files, comprising:

identifying a first rule group in said markup language rule pack file that corresponds to a rule group specified in a markup language rule group map file;

identifying a common setting within said first rule group, wherein a common setting applies to two or more monitoring rules in said a markup language rule pack file;

generating a rule group manifest file corresponding to said first rule group, wherein said common setting is not visible from a default view of said rule group manifest file;

repeating the steps above for each rule group specified in said markup language rule group map file.

18. A method according to claim 17, further comprising identifying a second rule group in said markup language rule pack file, wherein said second rule group does not correspond to any rule group specified in said markup language rule group map file, and generating a rule group manifest file corresponding to said second rule group.

19. A method according to claim 18, further comprising repeating the step of claim 18 for each rule group identified in said markup language rule pack file that does not correspond to any rule group specified in said markup language rule group map file.

20. A method according to claim 19, further comprising generating a file for a remainder of said markup language rule pack file and naming said file for a remainder of said markup language rule pack file as specified in said markup language rule group map file.